Using Google Cloud Identity-Aware Proxy (IAP) with RDP, you will be able to securely connect to your Virtual Instance running Microsoft Windows. Using IAP allows you to also connect to the instance even if it did not have a Public IP address.

1. You will need an existing Windows virtual machine ready and running on Compute Engine. You can reference Receipe 5.1 to install a Microsoft Windows Server in Google Cloud.
2. In the main menu of the Google Cloud Console, navigate to Networking and click VPC Network.
3. Click Firewall in the menu.
4. Click Create A Firewall Rule.
5. Enter a name for the firewall rule as allow-remote-iap.
6. For the Targets, select All Instances In The Network.
7. For Source IP Ranges, enter the following CIDR range: 35.235.240.0/20

The 35.235.240.0/20 CIDR range contains all IP addresses that Google Cloud IAP uses for TCP forwarding.

8. Select TCP and enter 3389 to allow RDP in the Protocols And Ports section,

9. Click Create.
10. Navigate to IAM & Admin > IAM in the Google Cloud Console menu.
11. Click Add to allow the groups and users to access IAP TCP forwarding, which will grant them access to connect to the instances in this project.
12. For the members, select the groups and or users to whom you want to grant access.
13. Select a role and choose IAP-Secured Tunnel User

14. Click Save.
15. Install the IAP Desktop application; you can find the download at https://github.com/GoogleCloudPlatform/iap-desktop. The IAP Desktop application allows you to manage multiple RDP and SSH connections to Google Compute instances securely with IAP.
16. Launch the IAP Desktop application and sign-in with the account you granted access to in step 13.
17. Select your Google Cloud project

18. Once successfully authenticated, you should see your Windows virtual machines listed

Using the IAP Desktop application also provides the following benefits:

• You do not need to expose SSH or RDP to the public internet.
• You can connect to virtual machines that do not have a public IP address.